Analysis Overview
SHA256
15dc859276438bb55a1bcbf226b4b6b18b471c0f2fcee8a68e953da61af12d8f
Threat Level: Shows suspicious behavior
The file exe2 was found to be: Shows suspicious behavior.
Malicious Activity Summary
Reads hardware information
Reads list of loaded kernel modules
Checks CPU configuration
Enumerates kernel/hardware configuration
Reads runtime system information
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-08-30 17:59
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-08-30 17:58
Reported
2024-08-30 18:01
Platform
ubuntu1804-amd64-20240729-en
Max time kernel
145s
Max time network
129s
Command Line
Signatures
Reads hardware information
| Description | Indicator | Process | Target |
| File opened for reading | /sys/class/dmi/id/product_uuid | /tmp/exe2 | N/A |
Reads list of loaded kernel modules
| Description | Indicator | Process | Target |
| File opened for reading | /proc/modules | /tmp/exe2 | N/A |
Checks CPU configuration
| Description | Indicator | Process | Target |
| File opened for reading | /proc/cpuinfo | /tmp/exe2 | N/A |
Enumerates kernel/hardware configuration
| Description | Indicator | Process | Target |
| File opened for reading | /sys/kernel/mm/transparent_hugepage/hpage_pmd_size | /tmp/exe2 | N/A |
| File opened for reading | /sys/kernel/mm/transparent_hugepage/hpage_pmd_size | /tmp/exe2 | N/A |
| File opened for reading | /sys/kernel/mm/transparent_hugepage/hpage_pmd_size | /tmp/exe2 | N/A |
Reads runtime system information
| Description | Indicator | Process | Target |
| File opened for reading | /proc/self/cpuset | /tmp/exe2 | N/A |
| File opened for reading | /proc/stat | /tmp/exe2 | N/A |
| File opened for reading | /proc/bus/pci/devices | /tmp/exe2 | N/A |
| File opened for reading | /proc/1/environ | /tmp/exe2 | N/A |
| File opened for reading | /proc/self/cgroup | /tmp/exe2 | N/A |
| File opened for reading | /proc/stat | /tmp/exe2 | N/A |
| File opened for reading | /proc/self/cpuset | /tmp/exe2 | N/A |
| File opened for reading | /proc/stat | /tmp/exe2 | N/A |
| File opened for reading | /proc/self/status | /tmp/exe2 | N/A |
| File opened for reading | /proc/self/cpuset | /tmp/exe2 | N/A |
Processes
/tmp/exe2
[/tmp/exe2]
/bin/uname
[uname -s]
/bin/uname
[uname -r]
/bin/uname
[uname -m]
/tmp/exe2
[/tmp/exe2]
/bin/uname
[uname -s]
/bin/uname
[uname -r]
/bin/uname
[uname -m]
/tmp/exe2
[/tmp/exe2]
/bin/uname
[uname -s]
/bin/uname
[uname -r]
/bin/uname
[uname -m]
Network
| Country | Destination | Domain | Proto |
| GB | 185.125.188.62:443 | tcp | |
| GB | 185.125.188.62:443 | tcp | |
| US | 151.101.193.91:443 | tcp | |
| US | 151.101.193.91:443 | tcp | |
| CN | 47.93.32.207:8080 | tcp | |
| N/A | 224.0.0.251:5353 | udp | |
| GB | 84.17.50.8:443 | tcp | |
| US | 1.1.1.1:53 | 1527653184.rsc.cdn77.org | udp |
| US | 1.1.1.1:53 | 1527653184.rsc.cdn77.org | udp |
| GB | 89.187.167.38:443 | 1527653184.rsc.cdn77.org | tcp |
| CN | 47.93.32.207:8080 | tcp |
Files
Analysis: behavioral2
Detonation Overview
Submitted
2024-08-30 17:58
Reported
2024-08-30 18:01
Platform
ubuntu2004-amd64-20240611-en
Max time kernel
146s
Max time network
134s
Command Line
Signatures
Reads hardware information
| Description | Indicator | Process | Target |
| File opened for reading | /sys/class/dmi/id/product_uuid | /tmp/exe2 | N/A |
Reads list of loaded kernel modules
| Description | Indicator | Process | Target |
| File opened for reading | /proc/modules | /tmp/exe2 | N/A |
Checks CPU configuration
| Description | Indicator | Process | Target |
| File opened for reading | /proc/cpuinfo | /tmp/exe2 | N/A |
Enumerates kernel/hardware configuration
| Description | Indicator | Process | Target |
| File opened for reading | /sys/kernel/mm/transparent_hugepage/hpage_pmd_size | /tmp/exe2 | N/A |
| File opened for reading | /sys/kernel/mm/transparent_hugepage/hpage_pmd_size | /tmp/exe2 | N/A |
| File opened for reading | /sys/kernel/mm/transparent_hugepage/hpage_pmd_size | /tmp/exe2 | N/A |
Reads runtime system information
| Description | Indicator | Process | Target |
| File opened for reading | /proc/bus/pci/devices | /tmp/exe2 | N/A |
| File opened for reading | /proc/self/cpuset | /tmp/exe2 | N/A |
| File opened for reading | /proc/stat | /tmp/exe2 | N/A |
| File opened for reading | /proc/self/cpuset | /tmp/exe2 | N/A |
| File opened for reading | /proc/stat | /tmp/exe2 | N/A |
| File opened for reading | /proc/self/cpuset | /tmp/exe2 | N/A |
| File opened for reading | /proc/stat | /tmp/exe2 | N/A |
| File opened for reading | /proc/self/status | /tmp/exe2 | N/A |
| File opened for reading | /proc/1/environ | /tmp/exe2 | N/A |
| File opened for reading | /proc/self/cgroup | /tmp/exe2 | N/A |
Processes
/tmp/exe2
[/tmp/exe2]
/usr/bin/uname
[uname -s]
/usr/bin/uname
[uname -r]
/usr/bin/uname
[uname -m]
/tmp/exe2
[/tmp/exe2]
/usr/bin/uname
[uname -s]
/usr/bin/uname
[uname -r]
/usr/bin/uname
[uname -m]
/tmp/exe2
[/tmp/exe2]
/usr/bin/uname
[uname -s]
/usr/bin/uname
[uname -r]
/usr/bin/uname
[uname -m]
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp | |
| US | 1.1.1.1:53 | connectivity-check.ubuntu.com | udp |
| CN | 47.93.32.207:8080 | tcp | |
| CN | 47.93.32.207:8080 | tcp | |
| US | 1.1.1.1:53 | connectivity-check.ubuntu.com | udp |
Files
Analysis: behavioral3
Detonation Overview
Submitted
2024-08-30 17:58
Reported
2024-08-30 18:01
Platform
ubuntu2204-amd64-20240729-en
Max time kernel
145s
Max time network
129s
Command Line
Signatures
Reads hardware information
| Description | Indicator | Process | Target |
| File opened for reading | /sys/class/dmi/id/product_uuid | /tmp/exe2 | N/A |
Reads list of loaded kernel modules
| Description | Indicator | Process | Target |
| File opened for reading | /proc/modules | /tmp/exe2 | N/A |
Checks CPU configuration
| Description | Indicator | Process | Target |
| File opened for reading | /proc/cpuinfo | /tmp/exe2 | N/A |
Enumerates kernel/hardware configuration
| Description | Indicator | Process | Target |
| File opened for reading | /sys/kernel/mm/transparent_hugepage/hpage_pmd_size | /tmp/exe2 | N/A |
| File opened for reading | /sys/kernel/mm/transparent_hugepage/hpage_pmd_size | /tmp/exe2 | N/A |
| File opened for reading | /sys/kernel/mm/transparent_hugepage/hpage_pmd_size | /tmp/exe2 | N/A |
Reads runtime system information
| Description | Indicator | Process | Target |
| File opened for reading | /proc/self/status | /tmp/exe2 | N/A |
| File opened for reading | /proc/stat | /tmp/exe2 | N/A |
| File opened for reading | /proc/stat | /tmp/exe2 | N/A |
| File opened for reading | /proc/self/cpuset | /tmp/exe2 | N/A |
| File opened for reading | /proc/bus/pci/devices | /tmp/exe2 | N/A |
| File opened for reading | /proc/1/environ | /tmp/exe2 | N/A |
| File opened for reading | /proc/self/cgroup | /tmp/exe2 | N/A |
| File opened for reading | /proc/self/cpuset | /tmp/exe2 | N/A |
| File opened for reading | /proc/self/cpuset | /tmp/exe2 | N/A |
| File opened for reading | /proc/stat | /tmp/exe2 | N/A |
Processes
/tmp/exe2
[/tmp/exe2]
/usr/bin/uname
[uname -s]
/usr/bin/uname
[uname -r]
/usr/bin/uname
[uname -m]
/tmp/exe2
[/tmp/exe2]
/usr/bin/uname
[uname -s]
/usr/bin/uname
[uname -r]
/usr/bin/uname
[uname -m]
/tmp/exe2
[/tmp/exe2]
/usr/bin/uname
[uname -s]
/usr/bin/uname
[uname -r]
/usr/bin/uname
[uname -m]
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp | |
| CN | 47.93.32.207:8080 | tcp | |
| CN | 47.93.32.207:8080 | tcp |
Files
Analysis: behavioral4
Detonation Overview
Submitted
2024-08-30 17:58
Reported
2024-08-30 18:01
Platform
ubuntu2404-amd64-20240523-en
Max time kernel
145s
Max time network
132s
Command Line
Signatures
Reads hardware information
| Description | Indicator | Process | Target |
| File opened for reading | /sys/class/dmi/id/product_uuid | /tmp/exe2 | N/A |
Reads list of loaded kernel modules
| Description | Indicator | Process | Target |
| File opened for reading | /proc/modules | /tmp/exe2 | N/A |
Checks CPU configuration
| Description | Indicator | Process | Target |
| File opened for reading | /proc/cpuinfo | /tmp/exe2 | N/A |
Enumerates kernel/hardware configuration
| Description | Indicator | Process | Target |
| File opened for reading | /sys/kernel/mm/transparent_hugepage/hpage_pmd_size | /tmp/exe2 | N/A |
| File opened for reading | /sys/kernel/mm/transparent_hugepage/hpage_pmd_size | /tmp/exe2 | N/A |
| File opened for reading | /sys/kernel/mm/transparent_hugepage/hpage_pmd_size | /tmp/exe2 | N/A |
Reads runtime system information
| Description | Indicator | Process | Target |
| File opened for reading | /proc/bus/pci/devices | /tmp/exe2 | N/A |
| File opened for reading | /proc/self/status | /tmp/exe2 | N/A |
| File opened for reading | /proc/self/cgroup | /tmp/exe2 | N/A |
| File opened for reading | /proc/stat | /tmp/exe2 | N/A |
| File opened for reading | /proc/stat | /tmp/exe2 | N/A |
| File opened for reading | /proc/stat | /tmp/exe2 | N/A |
| File opened for reading | /proc/1/environ | /tmp/exe2 | N/A |
| File opened for reading | /proc/self/cpuset | /tmp/exe2 | N/A |
| File opened for reading | /proc/self/cpuset | /tmp/exe2 | N/A |
| File opened for reading | /proc/self/cpuset | /tmp/exe2 | N/A |
Processes
/tmp/exe2
[/tmp/exe2]
/usr/bin/uname
[uname -s]
/usr/bin/uname
[uname -r]
/usr/bin/uname
[uname -m]
/tmp/exe2
[/tmp/exe2]
/usr/bin/uname
[uname -s]
/usr/bin/uname
[uname -r]
/usr/bin/uname
[uname -m]
/tmp/exe2
[/tmp/exe2]
/usr/bin/uname
[uname -s]
/usr/bin/uname
[uname -r]
/usr/bin/uname
[uname -m]
Network
| Country | Destination | Domain | Proto |
| N/A | 224.0.0.251:5353 | udp | |
| CN | 47.93.32.207:8080 | tcp | |
| CN | 47.93.32.207:8080 | tcp |